@elu-labs/elu 0.0.0-stage → 0.1.0

package/lib/peer/asks.mjs

@@ -0,0 +1,329 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { atomic, noSymlinks, readJson, refuse, isObject } from '../util.mjs';
+import { waitLock } from '../state.mjs';
+import { enqueue } from '../conductor.mjs';
+import { repository } from '../git.mjs';
+import { registeredProjects, taskDetails } from '../projects.mjs';
+import { BOT_NAME } from '../bots.mjs';
+import { peerFile, peerRepo } from './paths.mjs';
+import { peerPolicy } from './settings.mjs';
+import { plainName, sanitize } from './peerdata.mjs';
+import { teams } from './roster.mjs';
+import { prepareOutgoing, scanSecrets } from './secrets.mjs';
+import { PEER_EXT, REVIEW_MAX, TEXT_MAX, TaskState, isTerminal, message, textPart, validateTask } from './a2a.mjs';
+import { dropOutgoing, pushPictures } from './pictures.mjs';
+import { audit } from './taskstore.mjs';
+
+// Asks this machine sent (docs/peer-network.md):
+// asks/<id>.json = {id, to, name, messageId, threadId, taskId|null, kind, project, text,
+// state, attempts, nextAt, createdAt, expiresAt, answer|null, root, chatTaskId, reason, group?, bot?, pictures?}.
+// pictures: {set, list: [{id, n, name, size, type, sha256}], sentAt?, unsent?, reason?, kept?} for a
+// message the owner typed that named pictures (pictures.mjs); nothing else carries any.
+// A team ask is one ask per teammate sharing a group id and a thread. bot is the teammate's
+// shared bot a question is for; only a question to one teammate names one.
+// state: pending (not delivered), submitted, working, held, answered, rejected, failed,
+// canceled, expired. ctx: {me: identity, session(key), dial(key), event(text), kick()}.
+const DAY = 24 * 3600 * 1000;
+const ID = /^[a-f0-9-]{36}$/;
+const OPEN = ['pending', 'submitted', 'working', 'held'];
+const dir = () => peerFile('asks');
+const file = id => { if (!ID.test(id ?? '')) refuse('Choose an ask.'); return path.join(dir(), `${id}.json`); };
+const locked = fn => { const release = waitLock(peerRepo(), 'asks'); try { return fn(); } finally { release(); } };
+export function getAsk(id) {
+  try { const target = file(id); noSymlinks(target); if (!fs.existsSync(target)) return null; const value = readJson(target); return isObject(value) && value.id === id ? value : null; } catch { return null; }
+}
+export function asks() {
+  noSymlinks(dir()); if (!fs.existsSync(dir())) return [];
+  return fs.readdirSync(dir()).filter(name => ID.test(name.slice(0, -5)) && name.endsWith('.json')).flatMap(name => { const ask = getAsk(name.slice(0, -5)); return ask ? [ask] : []; });
+}
+const saveAsk = ask => { atomic(file(ask.id), ask); return ask; };
+const updateAsk = (id, fn) => locked(() => { const ask = getAsk(id); if (!ask) return null; const next = fn(ask); return next ? saveAsk(next) : ask; });
+
+// Active teammates by name or key, across every team this machine is in.
+export function teammate(me, who) {
+  const seen = new Map();
+  for (const team of teams()) {
+    if (!team.members.some(m => m.key === me.key && !m.removed)) continue;
+    for (const m of team.members) if (!m.removed && m.key !== me.key) seen.set(m.key, m);
+  }
+  // The TUI shows names without spaces or @, so that form and the 8-character fingerprint match too.
+  const value = String(who ?? '').replace(/^@/, ''), plain = text => String(text).replace(/[\s@]+/g, '').toLowerCase();
+  const exact = [...seen.values()].filter(m => m.key === value || m.name === value);
+  const found = exact.length ? exact : [...seen.values()].filter(m => plain(m.name) === plain(value) && plain(value) || /^[0-9a-f]{8,63}$/.test(value) && m.key.startsWith(value));
+  if (!found.length) refuse(`No teammate is named @${sanitize(value, 40)}.`);
+  if (found.length > 1) refuse(`More than one teammate is named @${sanitize(value, 40)}. Use their key.`);
+  return found[0];
+}
+const PROJECT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+export function createAsk(ctx, { to, kind = 'ask', project = null, text, root = null, chatTaskId = null, threadId = null, group = null, room = null, bot = null, byOwner = false, pictures = null }) {
+  if (!['ask', 'review', 'handoff'].includes(kind)) refuse('Choose ask, review or handoff.');
+  // Only the daemon's own commands for a message the owner typed pass pictures (stagedPictures).
+  if (pictures && (kind === 'review' || !byOwner)) refuse('Only a message you typed can carry pictures.');
+  if (project != null && !PROJECT.test(project)) refuse('A project is a share handle.');
+  if (bot != null && (typeof bot !== 'string' || !BOT_NAME.test(bot))) refuse('A bot name is 1 to 30 lowercase letters, digits or -, starting with a letter.');
+  if (bot != null && (kind !== 'ask' || group)) refuse('Only a question to one teammate can name a bot.');
+  const max = kind === 'review' ? REVIEW_MAX : TEXT_MAX;
+  if (typeof text !== 'string' || !text.trim() || text.length > max) refuse(`Write 1 to ${max} characters.`);
+  if (threadId != null && !/^[A-Za-z0-9_-]{1,128}$/.test(threadId)) refuse('Invalid thread.');
+  const member = teammate(ctx.me, to), now = Date.now();
+  // Agent drafts and local A2A callers write this text, so it is scanned like a reply.
+  // What the owner typed, or a draft the owner sent by hand (byOwner), goes as written: the
+  // owner decides what to tell a teammate, and a path or a long name is easily taken for a key.
+  // A trusted teammate gets it with its paths; the scan still refuses a secret.
+  const prepared = prepareOutgoing(text, { root, trusted: peerPolicy(member.key).trusted });
+  if (!prepared.ok && !byOwner) refuse(`This ${kind} contains a possible secret. Remove it before sending.`);
+  // A diff keeps its exact lines (--- /dev/null and all); other text loses paths outside the repository.
+  if (kind !== 'review') text = prepared.text;
+  const ask = saveAsk({ id: crypto.randomUUID(), to: member.key, name: sanitize(member.name, 64), messageId: crypto.randomUUID(), threadId: threadId ?? crypto.randomUUID(), taskId: null, kind, project, text,
+    state: 'pending', attempts: 0, nextAt: now, createdAt: new Date(now).toISOString(), expiresAt: new Date(now + 7 * DAY).toISOString(), answer: null, root, chatTaskId: chatTaskId == null ? null : String(chatTaskId), reason: null, ...(group ? { group } : {}), ...(room ? { room } : {}), ...(bot ? { bot } : {}), ...(kind !== 'review' && prepared.pathsCut ? { pathsCut: true } : {}), ...(pictures ? { pictures } : {}) });
+  audit(ask.threadId, { dir: 'out', peer: ask.to, kind, text });
+  if (!group) ctx.event(`${kind} to @${ask.name}`);
+  ctx.dial(ask.to); deliver(ctx, ask.id);
+  return ask;
+}
+// A question with no @name goes to every teammate; with a team, to everyone on it
+// (#general); with a channel too, to that channel's members. The first whose agent takes
+// it (its run starts) answers; the others' copies are then withdrawn (withdrawOthers).
+export const TEAM_MAX = 20;
+export function teamAsk(ctx, { project = null, text, root = null, chatTaskId = null, team = null, channel = null, byOwner = false, pictures = null }) {
+  const members = new Map(), mine = teams().filter(state => state.members.some(m => m.key === ctx.me.key && !m.removed));
+  let room = null, where = 'the team';
+  if (channel && !team) refuse('Name the team that channel is on.');
+  if (team) {
+    const state = mine.find(row => row.id === team); if (!state) refuse('You are not on that team.');
+    const found = channel ? state.channels.find(row => row.id === channel) : null;
+    if (channel && !found?.members.includes(ctx.me.key)) refuse('You are not in that channel.');
+    for (const m of state.members) if (!m.removed && m.key !== ctx.me.key && (!found || found.members.includes(m.key))) members.set(m.key, m);
+    if (found && !members.size) refuse(`No one else is in #${found.name}.`);
+    room = { team: state.id, channel: found?.id ?? null }; where = `#${found?.name ?? 'general'}`;
+  } else for (const state of mine) for (const m of state.members) if (!m.removed && m.key !== ctx.me.key) members.set(m.key, m);
+  if (!members.size) refuse('No teammates yet. Use /invite to add one.');
+  if (members.size > TEAM_MAX) refuse(`Your teams have more than ${TEAM_MAX} people. Ask one of them with @name.`);
+  // Scanned once up front, so a secret refuses the whole ask before any copy is saved.
+  if (!byOwner && typeof text === 'string' && !prepareOutgoing(text, { root }).ok) refuse('This ask contains a possible secret. Remove it before sending.');
+  const group = crypto.randomUUID(), threadId = crypto.randomUUID();
+  const sent = [...members.keys()].map(key => createAsk(ctx, { to: key, project, text, root, chatTaskId, threadId, group, room, byOwner, pictures }));
+  ctx.event(`ask to ${where} (${sent.length})`);
+  return sent;
+}
+const TAKEN = ['working', 'held', 'answered'];
+function withdrawOthers(ctx, taken) {
+  let withdrawn = 0;
+  for (const other of asks().filter(row => row.group === taken.group && row.id !== taken.id && ['pending', 'submitted'].includes(row.state))) {
+    const done = updateAsk(other.id, current => ['pending', 'submitted'].includes(current.state) ? { ...current, state: 'canceled', cancel: true, dismissed: true, reason: `@${taken.name} took it.` } : null);
+    if (done?.state === 'canceled' && done.cancel) { withdrawn++; void cancel(ctx, done.id); }
+  }
+  if (withdrawn) ctx.event(`@${taken.name} took the team ask`);
+}
+// Dismissing a team ask dismisses every copy; open ones are cancelled with their teammates.
+export function dismissTeam(ctx, group) {
+  const rows = asks().filter(row => row.group === group && !row.dismissed);
+  if (!rows.length) refuse('Choose an ask.');
+  return rows.map(row => dismissAsk(ctx, row.id));
+}
+// The diff of a local editing task, refused before sending when it is too large or
+// looks like it carries a secret.
+export function reviewText(root, taskId) {
+  const repo = registeredProjects().find(row => row.root === root) ?? repository(root);
+  const details = taskDetails(repo, String(taskId));
+  if (details.task.kind === 'conversation') refuse('Choose an editing task to review.');
+  const diff = details.diff.trim();
+  if (!diff) refuse('This task has no changes to review.');
+  if (diff.length > REVIEW_MAX) refuse(`This diff is over ${REVIEW_MAX} characters. Send a smaller change.`);
+  if (scanSecrets(diff).length) refuse('This diff contains a possible secret. Remove it before sending.');
+  return diff;
+}
+const backoff = attempts => Math.min(5000 * 2 ** attempts, 10 * 60000);
+const sending = new Set(), pushing = new Set();
+// The teammate answers at most 20 requests per 10 s and closes the connection past 40, so
+// this side sends asks, polls and cancels to one teammate at half that rate. Whatever is
+// left waits for a later tick.
+const PACE = 10, PACE_MS = 10000, sent = new Map();
+function allow(key, now = Date.now()) {
+  const recent = (sent.get(key) ?? []).filter(at => now - at < PACE_MS);
+  if (recent.length >= PACE) { sent.set(key, recent); return false; }
+  sent.set(key, [...recent, now]); return true;
+}
+// Sends a pending ask if its teammate is connected; otherwise it waits for a reconnect.
+const paced = async key => { while (!allow(key)) await new Promise(resolve => setTimeout(resolve, 250)); };
+// After the message went: what the teammate kept, and the copies for sending are removed
+// once no other ask still waits to send them.
+function settlePictures(id, sent, task) {
+  const done = updateAsk(id, current => {
+    if (!current.pictures) return null;
+    const kept = task.metadata?.[PEER_EXT]?.pictures, pictures = { ...current.pictures };
+    if (sent && Number.isInteger(kept) && kept < sent) Object.assign(pictures, { unsent: 'partly', kept });
+    if (sent && !pictures.unsent) pictures.sentAt = new Date().toISOString();
+    return { ...current, pictures };
+  });
+  if (done?.pictures && !asks().some(row => row.id !== id && row.state === 'pending' && row.pictures?.set === done.pictures.set)) dropOutgoing(done.pictures.set);
+}
+export async function deliver(ctx, id) {
+  let ask = getAsk(id); if (!ask || ask.state !== 'pending' || sending.has(id)) return;
+  // Pictures go first, in pieces, to one message per teammate at a time; the message then
+  // names them. A teammate who cannot take them gets the text alone.
+  const carries = Boolean(ask.pictures && !ask.pictures.unsent);
+  if (carries && pushing.has(ask.to)) return;
+  const session = ctx.session(ask.to); if (!session || !allow(ask.to)) return;
+  sending.add(id); if (carries) pushing.add(ask.to);
+  try {
+    let files = [];
+    if (carries) {
+      const pushed = await pushPictures(session, ask.pictures, () => paced(ask.to));
+      if (pushed.parts) files = pushed.parts;
+      else { ask = updateAsk(id, current => ({ ...current, pictures: { ...current.pictures, unsent: pushed.unsent, ...(pushed.reason ? { reason: pushed.reason } : {}) } })) ?? ask; ctx.event(`pictures to @${ask.name} not sent (${pushed.unsent})`); }
+      if (getAsk(id)?.state !== 'pending') return;
+    }
+    const params = { message: message({ text: ask.text, ...(files.length ? { parts: [textPart(ask.text), ...files] } : {}), contextId: ask.threadId, messageId: ask.messageId, ext: { kind: ask.kind, project: ask.project ?? null, hop: 1, from: { key: ctx.me.key, name: ctx.me.name.slice(0, 64) }, ...(ask.group ? { team: true } : {}), ...(ask.room ? { room: ask.room } : {}), ...(ask.bot ? { bot: ask.bot } : {}) } }) };
+    const result = await session.request('SendMessage', params);
+    if (!isObject(result?.task)) throw new Error('The teammate sent no task.');
+    if (ask.pictures) settlePictures(id, files.length, result.task);
+    applyTask(ctx, ask.to, result.task, id);
+  } catch (error) {
+    // Rate limits and internal errors (a disk or lock hiccup over there) are retried; refusals are final.
+    const final = Number.isInteger(error.details?.rpc?.code) && ![-32000, -32603].includes(error.details.rpc.code);
+    updateAsk(id, current => current.state !== 'pending' ? null : final
+      ? { ...current, state: 'failed', reason: sanitize(error.message, 300) }
+      : { ...current, attempts: current.attempts + 1, nextAt: Date.now() + backoff(current.attempts) });
+    if (final) ctx.event(`ask to @${ask.name} failed`);
+  } finally { sending.delete(id); if (carries) pushing.delete(ask.to); }
+}
+const answerText = task => (task.artifacts ?? []).flatMap(item => item.parts).filter(part => typeof part.text === 'string').map(part => part.text).join('\n\n');
+const statusText = task => task.status.message?.parts?.filter(part => typeof part.text === 'string').map(part => part.text).join(' ') ?? null;
+// Applies a Task from GetTask, SendMessage or elu.taskUpdate. Only the teammate the ask
+// went to can change it, and only for the task it returned.
+export function applyTask(ctx, from, value, askId = null) {
+  let current; try { current = validateTask(value); } catch { return null; }
+  const target = askId ? getAsk(askId) : asks().find(ask => ask.taskId === current.id && ask.to === from);
+  if (!target || target.to !== from || (target.taskId && target.taskId !== current.id)) return null;
+  // Dismissed while SendMessage was in flight: keep the task id so the cancel can go out.
+  if (!OPEN.includes(target.state)) { if (askId && target.cancel && !target.taskId) updateAsk(target.id, ask => ({ ...ask, taskId: current.id })); return null; }
+  const state = current.status.state, held = current.metadata?.['urn:elu-code:a2a-ext:peer:v1']?.substate === 'awaiting-owner';
+  const next = { [TaskState.SUBMITTED]: 'submitted', [TaskState.WORKING]: held ? 'held' : 'working', [TaskState.COMPLETED]: 'answered', [TaskState.REJECTED]: 'rejected', [TaskState.FAILED]: 'failed', [TaskState.CANCELED]: 'canceled' }[state] ?? 'working';
+  const ask = updateAsk(target.id, ask => {
+    if (!OPEN.includes(ask.state)) return null;
+    const update = { ...ask, taskId: current.id, state: next };
+    if (next === 'answered') update.answer = { text: sanitize(answerText(current), REVIEW_MAX), at: new Date().toISOString() };
+    if (isTerminal(state) && next !== 'answered') update.reason = sanitize(statusText(current) ?? '', 300) || null;
+    return update;
+  });
+  if (!ask || ask.state === target.state) return ask;
+  if (ask.group && TAKEN.includes(ask.state)) withdrawOthers(ctx, ask);
+  if (ask.state === 'answered') {
+    audit(ask.threadId, { dir: 'in', peer: ask.to, kind: 'answer', text: ask.answer.text });
+    ctx.event(`answer from @${ask.name}`);
+    if (ask.root && ask.chatTaskId && peerPolicy(ask.to).autoContinue) { try { continueAnswer(ctx, ask.id); } catch (error) { ctx.event(`continue failed: ${error.message}`); } }
+  } else if (isTerminal(state)) ctx.event(`${ask.kind} to @${ask.name} ${ask.state}`);
+  return ask;
+}
+// Queues a follow-up in the chat the ask came from, with the answer as peer data.
+export function continueAnswer(ctx, id) {
+  const ask = getAsk(id);
+  if (!ask || ask.state !== 'answered' || !ask.answer) refuse('That ask has no answer yet.');
+  if (!ask.root || !ask.chatTaskId) refuse('That ask did not come from a chat.');
+  if (ask.continued) refuse('That answer was already continued.');
+  const name = ask.name.replace(/["<>\t\n]/g, '').trim() || ask.to.slice(0, 8);
+  const row = enqueue(ask.root, `Continue with the answer from @${plainName(ask.name, ask.to)} shown in the peer data block.`, {
+    continuationTaskId: ask.chatTaskId, priority: 0, readOnly: true,
+    origin: { kind: 'answer', peer: ask.to, name, a2aTaskId: ask.taskId, threadId: ask.threadId, hop: 0 }, context: ask.answer.text.slice(0, TEXT_MAX),
+  });
+  updateAsk(id, current => ({ ...current, continued: true, continuedAt: new Date().toISOString() }));
+  ctx.kick(); return row;
+}
+// Dismissing an open ask cancels it with the teammate, so it never runs on their budget.
+export function dismissAsk(ctx, id) {
+  const ask = updateAsk(id, current => ({ ...current, dismissed: true, ...(OPEN.includes(current.state) ? { state: 'canceled', cancel: true } : {}) }));
+  if (!ask) refuse('Choose an ask.');
+  if (ask.cancel) void cancel(ctx, ask.id);
+  return ask;
+}
+// Sends CancelTask for an ask marked cancel (dismissed or expired). Done when the teammate
+// cancels it, says it is finished or unknown, or never received it.
+export async function cancel(ctx, id) {
+  const ask = getAsk(id); if (!ask?.cancel || sending.has(id)) return;
+  if (!ask.taskId) return void updateAsk(id, current => current.taskId ? null : { ...current, cancel: false });
+  const session = ctx.session(ask.to); if (!session || !allow(ask.to)) return;
+  sending.add(id);
+  try { await session.request('CancelTask', { id: ask.taskId }); updateAsk(id, current => ({ ...current, cancel: false })); }
+  catch (error) { if ([-32001, -32002].includes(error.details?.rpc?.code)) updateAsk(id, current => ({ ...current, cancel: false })); }
+  finally { sending.delete(id); }
+}
+// Polls one open ask with GetTask. A rate limit or a timeout tries again later.
+async function poll(ctx, ask) {
+  const session = ctx.session(ask.to); if (!session || sending.has(ask.id) || !allow(ask.to)) return;
+  sending.add(ask.id);
+  try { applyTask(ctx, ask.to, await session.request('GetTask', { id: ask.taskId }), ask.id); updateAsk(ask.id, current => ({ ...current, pollAt: null, polls: 0 })); }
+  catch (error) {
+    if (error.details?.rpc?.code === -32001) updateAsk(ask.id, current => ({ ...current, state: 'failed', reason: 'The teammate no longer has this task.', pollAt: null }));
+    else updateAsk(ask.id, current => ({ ...current, polls: (current.polls ?? 0) + 1, pollAt: Date.now() + backoff(current.polls ?? 0) }));
+  } finally { sending.delete(ask.id); }
+}
+// On connect: what waits for this teammate goes out, and what they still hold is polled,
+// at the paced rate; tickAsks sends the rest.
+export async function reconnect(ctx, key) {
+  for (const ask of asks().filter(ask => ask.to === key)) {
+    if (ask.state === 'pending') updateAsk(ask.id, current => ({ ...current, nextAt: 0 }));
+    else if (OPEN.includes(ask.state) && ask.taskId) updateAsk(ask.id, current => ({ ...current, pollAt: 0, polls: 0 }));
+  }
+  await pump(ctx, key);
+}
+async function pump(ctx, key, now = Date.now()) {
+  for (const ask of asks().filter(ask => ask.to === key)) {
+    if (!ctx.session(key) || (sent.get(key) ?? []).filter(at => now - at < PACE_MS).length >= PACE) return;
+    if (ask.cancel) await cancel(ctx, ask.id);
+    else if (ask.state === 'pending' && ask.nextAt <= now) await deliver(ctx, ask.id);
+    else if (OPEN.includes(ask.state) && ask.taskId && ask.pollAt != null && ask.pollAt <= now) await poll(ctx, ask);
+  }
+}
+export function tickAsks(ctx, now = Date.now()) {
+  const keys = new Set();
+  for (const ask of asks()) {
+    if (ask.cancel) { if (ask.taskId) keys.add(ask.to); else cancel(ctx, ask.id); continue; }
+    if (!OPEN.includes(ask.state)) continue;
+    if (Date.parse(ask.expiresAt) <= now) { updateAsk(ask.id, current => OPEN.includes(current.state) ? { ...current, state: 'expired', cancel: true } : null); ctx.event(`${ask.kind} to @${ask.name} expired`); keys.add(ask.to); continue; }
+    if (ask.state === 'pending' && ask.nextAt <= now) {
+      // Offline: dial on the ask's own backoff; Hyperswarm retries in between.
+      if (!ctx.session(ask.to)) { updateAsk(ask.id, current => ({ ...current, attempts: current.attempts + 1, nextAt: now + backoff(current.attempts) })); ctx.dial(ask.to); continue; }
+      keys.add(ask.to);
+    }
+    if (ask.pollAt != null && ask.pollAt <= now) keys.add(ask.to);
+  }
+  for (const key of keys) if (ctx.session(key)) pump(ctx, key, now).catch(() => {});
+}
+
+// Agent drafts (drafts/<id>.json from the runner): approved ones, and drafts to
+// teammates set to autoAsk, become asks.
+const draftFile = id => { if (!ID.test(id ?? '')) refuse('Choose a draft.'); return peerFile('drafts', `${id}.json`); };
+export function drafts() {
+  const folder = peerFile('drafts'); noSymlinks(folder); if (!fs.existsSync(folder)) return [];
+  return fs.readdirSync(folder).filter(name => name.endsWith('.json') && ID.test(name.slice(0, -5))).flatMap(name => {
+    try { const value = readJson(path.join(folder, name)); return isObject(value) && value.id === name.slice(0, -5) ? [value] : []; } catch { return []; }
+  });
+}
+export function sendDraft(ctx, id, { byOwner = false } = {}) {
+  const target = draftFile(id); noSymlinks(target);
+  const release = waitLock(peerRepo(), 'drafts');
+  let draft;
+  try {
+    draft = fs.existsSync(target) ? readJson(target) : null;
+    if (!draft || draft.state !== 'draft') refuse('No draft is waiting.');
+    atomic(target, { ...draft, state: 'sending' });
+  } finally { release(); }
+  try {
+    const ask = createAsk(ctx, { to: draft.to, project: draft.project ?? null, text: String(draft.question ?? ''), root: draft.root ?? null, chatTaskId: draft.taskId ?? null, threadId: draft.threadId ?? null, byOwner });
+    atomic(target, { ...draft, state: 'sent', askId: ask.id }); return ask;
+  } catch (error) { atomic(target, { ...draft, state: 'draft', error: error.message }); throw error; }
+}
+export function discardDraft(id) {
+  const target = draftFile(id); noSymlinks(target);
+  if (!fs.existsSync(target)) refuse('No draft is waiting.');
+  const draft = readJson(target); atomic(target, { ...draft, state: 'discarded' }); return draft;
+}
+export function autoDrafts(ctx) {
+  for (const draft of drafts().filter(row => row.state === 'draft' && !row.error)) {
+    let member; try { member = teammate(ctx.me, draft.to); } catch { continue; }
+    if (peerPolicy(member.key).autoAsk) { try { sendDraft(ctx, draft.id); } catch { /* Kept as a draft with its error. */ } }
+  }
+}

package/lib/peer/canonical.mjs

@@ -0,0 +1,72 @@
+import crypto from 'node:crypto';
+import { isObject, refuse } from '../util.mjs';
+
+// Canonical JSON: object keys sorted (by UTF-16 code units) at every level, no whitespace.
+// Only JSON values are accepted, so a signature never covers something JSON would drop
+// or rewrite (undefined, functions, NaN, Dates, Buffers, sparse arrays).
+const MAX_DEPTH = 32;
+function encode(value, depth) {
+  if (depth > MAX_DEPTH) refuse('Signed data is nested too deeply.');
+  if (value === null || typeof value === 'boolean' || typeof value === 'string') return JSON.stringify(value);
+  if (typeof value === 'number') { if (!Number.isFinite(value)) refuse('Signed data has a number JSON cannot hold.'); return JSON.stringify(value); }
+  if (Array.isArray(value)) {
+    const out = [];
+    for (let i = 0; i < value.length; i++) { if (!(i in value)) refuse('Signed data has an empty array slot.'); out.push(encode(value[i], depth + 1)); }
+    return `[${out.join(',')}]`;
+  }
+  const proto = isObject(value) ? Object.getPrototypeOf(value) : undefined;
+  if (proto !== Object.prototype && proto !== null) refuse('Signed data must be plain JSON.');
+  return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${encode(value[key], depth + 1)}`).join(',')}}`;
+}
+export const canonical = value => encode(value, 0);
+
+// Keys are raw 32-byte ed25519 values. Node takes them only as DER, so the fixed
+// PKCS#8 and SPKI prefixes for ed25519 are prepended. hyperdht's DHT.keyPair(seed)
+// derives the same public key from the same seed, so one seed is also the transport key.
+const PKCS8 = Buffer.from('302e020100300506032b657004220420', 'hex');
+const SPKI = Buffer.from('302a300506032b6570032100', 'hex');
+const HEX64 = /^[0-9a-f]{64}$/;
+function seedBytes(seed) {
+  if (!Buffer.isBuffer(seed) || seed.length !== 32) refuse('A signing seed must be 32 bytes.');
+  return seed;
+}
+export const privateKey = seed => crypto.createPrivateKey({ key: Buffer.concat([PKCS8, seedBytes(seed)]), format: 'der', type: 'pkcs8' });
+export function publicKey(key) {
+  if (typeof key !== 'string' || !HEX64.test(key)) refuse('A public key must be 64 hex characters.');
+  return crypto.createPublicKey({ key: Buffer.concat([SPKI, Buffer.from(key, 'hex')]), format: 'der', type: 'spki' });
+}
+export function publicKeyHex(seed) {
+  return crypto.createPublicKey(privateKey(seed)).export({ format: 'der', type: 'spki' }).subarray(SPKI.length).toString('hex');
+}
+export const sign = (seed, value) => crypto.sign(null, Buffer.from(canonical(value)), privateKey(seed)).toString('hex');
+// Never throws: a malformed key, signature or value is simply not verified.
+export function verify(key, value, sig) {
+  try {
+    if (typeof sig !== 'string' || !/^[0-9a-f]{128}$/.test(sig)) return false;
+    return crypto.verify(null, Buffer.from(canonical(value)), publicKey(key), Buffer.from(sig, 'hex'));
+  } catch { return false; }
+}
+
+// RFC 4648 base32, lowercase and unpadded, for codes people paste.
+const ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567';
+export function base32(bytes) {
+  let bits = 0, value = 0, out = '';
+  for (const byte of bytes) {
+    value = (value << 8) | byte; bits += 8;
+    while (bits >= 5) { out += ALPHABET[(value >>> (bits - 5)) & 31]; bits -= 5; }
+    value &= (1 << bits) - 1;
+  }
+  return bits ? out + ALPHABET[(value << (5 - bits)) & 31] : out;
+}
+// Strict: only the lowercase alphabet, no padding, and no stray trailing bits, so each
+// byte string has exactly one accepted spelling.
+export function unbase32(text) {
+  if (typeof text !== 'string' || !/^[a-z2-7]*$/.test(text) || [1, 3, 6].includes(text.length % 8)) return null;
+  let bits = 0, value = 0; const out = [];
+  for (const char of text) {
+    value = (value << 5) | ALPHABET.indexOf(char); bits += 5;
+    if (bits >= 8) { out.push((value >>> (bits - 8)) & 255); bits -= 8; }
+    value &= (1 << bits) - 1;
+  }
+  return value === 0 ? Buffer.from(out) : null;
+}

package/lib/peer/cli.mjs

@@ -0,0 +1,154 @@
+import os from 'node:os';
+import path from 'node:path';
+import { refuse } from '../util.mjs';
+import * as peer from './index.mjs';
+import { loadIdentity, validName } from './identity.mjs';
+import { appendOp, makeOp, teams } from './roster.mjs';
+import { peerFile } from './paths.mjs';
+import { teammate } from './asks.mjs';
+import { sanitize } from './peerdata.mjs';
+
+// The peer commands of bin/elu-code.mjs (README, "Teammates"). Each returns a
+// result with a message and display lines; --json prints the whole result instead.
+const live = () => peer.peerStatus().running;
+async function daemonCall(command, timeoutMs = 30000) {
+  if (!live()) refuse('The peer daemon is not running. Run elu peer on.');
+  return peer.awaitCommand(peer.sendPeerCommand(command).id, timeoutMs);
+}
+const myTeams = me => teams().filter(state => state.members.some(m => m.key === me.key && !m.removed));
+// --team takes an id, an id prefix of 8 or more characters, or a name; without it there must be one team.
+function chooseTeam(me, value, { admin = false } = {}) {
+  const mine = myTeams(me).filter(state => !admin || state.members.some(m => m.key === me.key && m.role === 'admin'));
+  if (!mine.length) refuse(admin ? 'You are not an admin of any team.' : 'Create a team first with elu team create NAME.');
+  if (value === undefined) { if (mine.length > 1) refuse('Choose a team with --team.'); return mine[0]; }
+  const found = mine.filter(state => state.id === value || (value.length >= 8 && state.id.startsWith(value)) || state.name === value);
+  if (found.length !== 1) refuse(found.length ? 'More than one team matches. Use its id.' : 'No team of yours matches --team.');
+  return found[0];
+}
+const shown = me => ({ name: me.name, key: me.key, fingerprint: me.fingerprint, createdAt: me.createdAt });
+// When a teammate is added, the project they can ask about is chosen too: --project PATH, else
+// this folder when it can be shared. Only a --project that fails is an error.
+function teamShare(teamId, flags) {
+  const where = flags.project === undefined ? process.cwd() : path.resolve(String(flags.project));
+  try { return { row: peer.share(where, { teams: [teamId] }) }; }
+  catch (error) { return { error: flags.project === undefined ? null : error.message }; }
+}
+const askAbout = ({ row, error }) => row ? ` Your teammates can ask about ${row.handle}, the folder ${row.root}.` : error ? ` Not shared: ${error}` : ' Run elu share in a project so your teammates can ask about it.';
+function memberLines(status) {
+  const lines = [];
+  for (const state of status.teams) {
+    lines.push(`${state.name} (${state.id.slice(0, 8)}, ${state.role})`);
+    for (const m of state.members) lines.push(`  ${m.key === status.key ? '●' : m.online ? '●' : '○'} ${m.name}  ${m.role}  ${m.key === status.key ? 'you' : m.online ? m.path ?? 'direct' : 'offline'}${m.key !== status.key && peer.peerPolicy(m.key).trusted ? '  trusted' : ''}`);
+  }
+  return lines;
+}
+// elu peer trust|untrust @NAME: writes peers.json directly; the daemon
+// reads trust per send, so no restart is needed.
+function trustCommand(action, words) {
+  if (!words[2] || words.length > 3) refuse(`Use elu peer ${action} @NAME.`);
+  const member = teammate(peer.identity(), words[2]), name = sanitize(member.name, 40).replace(/[\s@]+/g, '') || member.key.slice(0, 8);
+  const { trusted } = peer.savePeerPolicy(member.key, { trusted: action === 'trust' });
+  return { peer: { key: member.key, name: member.name, trusted }, message: trusted ? `Trusted @${name}. Paths go out as they are. Their text shows as sent.` : `@${name} is no longer trusted. Paths go out as [path].` };
+}
+
+function idCommand(flags) {
+  if (flags.import) return { identity: shown(peer.importIdentity(flags.import)), message: 'Identity imported.' };
+  let me = loadIdentity(), message = 'This is your peer identity.';
+  if (!me) {
+    const name = flags.name ?? os.userInfo().username.replace(/[^\p{L}\p{N}._-]/gu, '').slice(0, 40);
+    if (!validName(name)) refuse('Choose a name with --name.');
+    me = peer.identity({ create: true, name }); message = 'Peer identity created.';
+  } else if (flags.name !== undefined) { me = peer.identity({ name: flags.name }); message = 'Name changed.'; }
+  const result = { identity: shown(me), message, lines: [`${me.name}  ${me.fingerprint}`, `Key: ${me.key}`] };
+  if (flags.export) { result.code = peer.exportIdentity(); result.lines.push('Export code. Anyone with it can act as you; keep it secret:', result.code); }
+  return result;
+}
+async function peerMode(words) {
+  const action = words[1] ?? 'status';
+  if (action === 'on') {
+    peer.startPeer();
+    // Wait for the first heartbeat, so a start failure shows here and not only in the log.
+    for (let until = Date.now() + 20000; Date.now() < until && !live();) await new Promise(resolve => setTimeout(resolve, 200));
+    if (!live()) refuse(`The peer daemon did not start. See ${peerFile('daemon.log')}.`);
+    return { peer: peer.peerStatus(), message: 'Peer mode is on.' };
+  }
+  if (action === 'off') { peer.stopPeer(); return { message: 'Peer mode is off.' }; }
+  if (action === 'status') {
+    const status = peer.peerStatus(), settings = peer.peerSettings();
+    return { peer: status, settings, message: `Peer mode is ${settings.enabled ? 'on' : 'off'}; the daemon is ${status.running ? 'running' : 'stopped'}.`, lines: [...status.error ? [`Error: ${status.error}`] : [], ...memberLines(status)] };
+  }
+  if (action === 'install') return { service: peer.installService(), message: 'The peer daemon now starts at login.' };
+  if (action === 'uninstall') return { service: peer.uninstallService(), message: 'The peer daemon no longer starts at login.' };
+  if (action === 'trust' || action === 'untrust') return trustCommand(action, words);
+  refuse(`Unknown command: peer ${action}. Use elu peer on|off|status|install|uninstall|trust @NAME|untrust @NAME.`);
+}
+
+export async function peerCli(words, flags) {
+  const [command] = words;
+  if (command === 'id') return idCommand(flags);
+  if (command === 'peer') return peerMode(words);
+  if (command === 'team') {
+    if (words[1] === 'create') {
+      const name = words.slice(2).join(' ');
+      const made = peer.createTeam(name);
+      return { team: { id: made.id, name: made.name }, message: `Team ${made.name} created. Add a teammate with elu invite.` };
+    }
+    if (words[1]) refuse(`Unknown command: team ${words[1]}. Use elu team create NAME.`);
+    const status = peer.peerStatus();
+    return { teams: status.teams, message: status.teams.length ? `${status.teams.length} team${status.teams.length === 1 ? '' : 's'}.` : 'No team yet. Create one with elu team create NAME.', lines: memberLines(status) };
+  }
+  if (command === 'invite') {
+    const me = peer.identity(), state = chooseTeam(me, flags.team, { admin: true }), hours = flags.hours === undefined ? 24 : Number(flags.hours);
+    const shared = teamShare(state.id, flags);
+    if (shared.error) refuse(shared.error);
+    const code = peer.createInvite(state.id, { hours });
+    return { invite: { code, team: state.id, hours, project: shared.row?.handle ?? null }, message: `Invite to ${state.name}. It works once, within ${hours} h.${askAbout(shared)}${live() ? '' : ' Turn on peer mode (elu peer on) so they can join.'}`, lines: [code, 'Your teammate runs it in the project you can ask about: elu join <code>'] };
+  }
+  if (command === 'join') {
+    if (!words[1] || words.length > 2) refuse('Use elu join CODE.');
+    const joined = await peer.joinTeam(words[1]), shared = teamShare(joined.id, flags);
+    return { team: { ...joined, project: shared.row?.handle ?? null }, message: `Joined ${joined.name}.${askAbout(shared)}${live() ? '' : ' Run elu peer on to talk to your teammates.'}` };
+  }
+  if (command === 'share') {
+    if (words.length > 2) refuse('Use elu share [PATH] [--as HANDLE] [--no-status].');
+    const row = peer.share(path.resolve(words[1] ?? process.cwd()), { handle: flags.as, status: !flags['no-status'] });
+    return { share: row, message: `Shared ${row.root} with your teams as ${row.handle}. Questions that name no project go to it.` };
+  }
+  if (command === 'unshare') {
+    if (words.length !== 2) refuse('Use elu unshare HANDLE.');
+    const row = peer.unshare(words[1]);
+    return { share: row, message: `Stopped sharing ${row.handle}.` };
+  }
+  if (command === 'peers') {
+    const status = peer.peerStatus(), items = peer.peerItems(), agents = peer.teamAgents();
+    const lines = [...memberLines(status), ...items.map(item => `${item.kind}  @${item.name}  ${item.text ?? ''}`.slice(0, 160))];
+    return { peer: status, items, agents, message: `The daemon is ${status.running ? 'running' : 'stopped'}. ${items.length} peer item${items.length === 1 ? '' : 's'}.`, lines };
+  }
+  if (command === 'ask') {
+    const to = words[1] ?? '', text = words.slice(2).join(' ');
+    // No @NAME: every teammate gets it, and the first to take it answers.
+    if (to && !to.startsWith('@')) {
+      const { askIds } = await daemonCall({ type: 'teamAsk', project: flags.project ?? null, text: words.slice(1).join(' ') });
+      return { askIds, message: `Asked your team (${askIds.length}). The first teammate to take it answers; see elu peers.` };
+    }
+    if (!/^@[^\s@/\\]{1,64}$/.test(to) || !text.trim()) refuse('Use elu ask [@NAME] [--project H] TEXT.');
+    const { askId } = await daemonCall({ type: 'ask', to: to.slice(1), project: flags.project ?? null, text });
+    return { askId, message: `Asked ${to}. The answer shows in elu peers.` };
+  }
+  refuse(`Unknown command: ${words.join(' ')}. Use elu --help.`);
+}
+
+// elu relay: serves the chosen team (or every team), and as an admin adds its key to that
+// team's roster so teammates' daemons use it after their next start.
+export async function startRelay(flags) {
+  const me = peer.identity(), chosen = flags.team === undefined ? null : chooseTeam(me, flags.team);
+  const { runRelay } = await import('./relay.mjs');
+  const relay = await runRelay({ identity: me, bootstrap: peer.peerSettings().bootstrap, teams: chosen ? [chosen.id] : null });
+  const added = [];
+  for (const state of chosen ? [chosen] : myTeams(me)) {
+    if (!state.members.some(m => m.key === me.key && m.role === 'admin') || state.relays.includes(relay.key) || state.relays.length >= 16) continue;
+    appendOp(state.id, makeOp(me, state.id, 'relays', { keys: [...state.relays, relay.key] })); added.push(state.name);
+  }
+  const result = { relay: { key: relay.key, teams: chosen ? [chosen.id] : myTeams(me).map(state => state.id) }, message: `Relay running. Key: ${relay.key}`, lines: [added.length ? `Added to the roster of ${added.join(', ')}.` : 'A team admin adds this key to the roster.', 'Press Ctrl-C to stop.'] };
+  return { relay, result };
+}